PRIVACY POLICY

Pullup Matchmaker Ltd

Last updated: June 2026

Compliant with UK GDPR, Data Protection Act 2018 and the Data (Use and Access) Act 2025

1. Who We Are

Pullup Matchmaker Ltd (trading as “Pullup”) is a company registered in England and Wales. We operate the Pullup Matchmaker platform a sports matchmaking service that connects Players with self-employed Moderators who host 5v5 basketball sessions across London.

We are the data controller for all personal data collected through our platform and website. This means we are responsible for deciding how and why your personal data is used.

Company: Pullup Matchmaker Ltd

Email: admin@pullupmatchmaker.com

Address: Shimogamo, Llanreath Beach Road, Pembroke Dock, SA72 6TP, Wales, United Kingdom

Website: www.pullupmatchmaker.com

If you have any questions about this Privacy Policy or how we handle your data, please contact us at the email above. We will respond within one month of receiving your request.

2. About This Policy

This Privacy Policy explains what personal data we collect about you, why we collect it, how we use it, who we share it with, and what rights you have. It applies to all users of our platform including Players, Moderators, and website visitors.

Please read this policy carefully. By using the Pullup Matchmaker platform, you confirm you have read and understood how we use your personal data.

We keep this policy under regular review and will notify you of any material changes by email or by a prominent notice on our platform. The Data (Use and Access) Act 2025 (DUAA 2025), which came into force on 19 June 2025, has clarified certain aspects of the purpose limitation principle under UK GDPR. Where relevant, our processing reflects the updated guidance issued by the ICO in accordance with the DUAA 2025.

3. Who This Policy Covers

This policy applies to three categories of people:

Players - registered users who pay to join basketball sessions listed on the platform.

Moderators - self-employed individuals who list, organise, and host sessions via the platform. Moderators are independent contractors, not employees of Pullup Matchmaker.

Visitors - anyone who visits our website without registering.

Where our data practices differ between Players and Moderators, we have made this clear throughout this policy.

4. Age Restrictions - 16+ Platform

Our platform is strictly for users aged 16 and over. We do not knowingly collect personal data from anyone under the age of 16. If we become aware that a user is under 16, we will immediately delete their data and terminate their account.

4.1 Users Aged 16 and 17

Users aged 16 and 17 are permitted to use our platform. In line with our obligations under the ICO’s Age Appropriate Design Code (the “Children’s Code”), issued under Section 123 of the Data Protection Act 2018, we apply the following enhanced protections for these users:

• We apply the highest available privacy settings by default to accounts held by users aged 16 or 17.

• We collect only the minimum personal data strictly necessary to provide our service to these users.

• We do not use data belonging to users aged 16 or 17 for profiling, behavioural advertising, or any purpose beyond what is strictly necessary to deliver the platform.

• We do not use nudge techniques or design features that encourage younger users to share more data than is necessary.

• We do not share personal data of users aged 16 or 17 with third parties except where strictly required to deliver the service.

We may ask users to verify their age. Providing false information about your age is a breach of our Terms of Service.

5. Personal Data We Collect

5.1 Player Data

When you register and use the platform as a Player, we may collect:

• Identity data: full name, date of birth, and profile photograph.

• Contact data: email address and phone number.

• Physical data: Sex, body type/physical profile and height (where provided, for matchmaking purposes).

• Session data: games attended, booking history, session history, and any reviews or feedback submitted.

• Payment data: processed by Stripe. We do not store your full card details directly see Section 8.

• Technical data: IP address, browser type, device type, operating system, and location data.

• Usage data: how you interact with our platform, pages visited, features used, and time spent.

• Communications data: any messages sent to us or through our platform.

5.2 Moderator Data

When you register as a Moderator, we collect all of the above plus:

• Facial identity verification data: collected as part of our onboarding process to verify your identity.

• Bank or payment account details: to facilitate payment of the £15 session fee.

• Right to work verification: where required to confirm your able to work in the UK.

5.3 Visitor Data

If you visit our website without registering, we automatically collect technical data including your IP address, browser type, and device information via Framer (our website host) and PostHog (our analytics provider). See Section 8 for details.

5.4 Data You Choose Not to Provide

Where we need personal data to fulfil a contract with you or comply with a legal obligation, failure to provide it may mean we cannot provide the relevant service. We will tell you at the time of collection if providing data is mandatory or optional.

6. How We Collect Your Data

We collect personal data through the following methods:

Direct interactions: when you create an account, make a booking, join our waitlist, contact us, or submit any form on our platform.

Automated technologies: as you use our platform, we automatically collect technical and usage data through cookies, server logs, and analytics tools. See our Cookie Policy for full details.

Third party sources: we may receive technical data from analytics providers (PostHog) and payment confirmation data from Stripe.

Identity verification providers: facial ID verification data is collected through our third-party identity verification provider during Moderator onboarding.

7. How We Use Your Personal Data and Our Lawful Basis

We only process your personal data where we have a lawful basis to do so under Article 6 of UK GDPR. The table below sets out each processing activity, the data involved, and our lawful basis.

Purpose	Data Used	Lawful Basis	Retention
Register and manage your account	Identity, Contact	Contract performance (Art. 6(1)(b))	Duration of account + 2 years
Process bookings and payments	Identity, Contact, Payment, Session	Contract performance (Art. 6(1)(b))	7 years (HMRC requirements)
Verify Moderator identity (facial ID)	Facial biometric data	Legal obligation / Legitimate interests (Art. 6(1)(c)/(f))	6 months post-verification
Matchmaking and session allocation	Identity, Physical (height, sex and body type/physical profile), Session history, Location	Contract performance (Art. 6(1)(b))	Duration of account
Send booking confirmations and service updates	Identity, Contact	Contract performance (Art. 6(1)(b))	Duration of account + 2 years
Send marketing emails (with consent)	Identity, Contact, Usage	Consent (Art. 6(1)(a))	Until consent withdrawn
Platform analytics and improvement	Technical, Usage	Legitimate interests (Art. 6(1)(f))	26 months
Fraud prevention and platform security	Identity, Contact, Technical	Legitimate interests / Legal obligation (Art. 6(1)(c)/(f))	6 years
Comply with legal and regulatory obligations	All categories as required	Legal obligation (Art. 6(1)(c))	As required by law
Handle complaints and disputes	Identity, Contact, Session, Communications	Legitimate interests / Legal obligation (Art. 6(1)(c)/(f))	6 years from resolution
Pay Moderators their session fee	Identity, Bank/payment details	Contract performance (Art. 6(1)(b))	7 years (HMRC requirements)

7.1 Legitimate Interests

Where we rely on legitimate interests as our lawful basis, we have carefully assessed those interests against any potential impact on your rights and freedoms. Our legitimate interests include running and improving our platform, preventing fraud, ensuring the safety of our users, and developing our service. If you would like further information about any specific legitimate interests assessment, please contact us.

7.2 Consent

Where we rely on your consent for example for marketing emails, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before your withdrawal. You can withdraw consent by clicking the unsubscribe link in any marketing email or by contacting us directly.

8. Third Party Processors

We share your personal data with the following third-party service providers. All third parties are required to process your data securely, in accordance with our instructions, and in compliance with UK GDPR. We do not permit third parties to use your data for their own purposes.

Provider	Purpose	Data Shared	Location / Transfer Safeguard
Stripe	Payment processing, Moderator facial ID verification and right to work verification.	Payment card data, Identity, Contact, Facial biometric data, Identity data, right to work data.	US Standard Contractual Clauses (SCCs)
Framer	Website hosting and delivery	Technical data, IP address	US Standard Contractual Clauses (SCCs)
Mailerlite	Email marketing and CRM	Name, Email, Marketing preferences	US Standard Contractual Clauses (SCCs)
PostHog	Product analytics	Technical data, Usage data, IP address (anonymised)	US Standard Contractual Clauses (SCCs)

We may also share your personal data with professional advisers including lawyers, accountants, and insurers where necessary, and with HM Revenue & Customs or other regulatory authorities where required by law.

We will never sell your personal data to third parties or share it with third parties for their own marketing purposes.

9. Automated Decision-Making and Profiling

Our matchmaking algorithm uses personal data to suggest suitable sessions to Players. This may involve processing identity data, location data, session history, and where provided, physical characteristics such as height. This helps us connect Players with sessions that are appropriate for them.

Under UK GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect on you. Our matchmaking process does not produce decisions of this nature session suggestions are recommendations only and no Player is excluded from any session solely by automated means without human oversight.

If you have concerns about how automated processing affects you, or would like a human review of any decision, please contact us at admin@pullupmatchmaker.com.

10. International Data Transfers

Some of our third-party service providers are located outside the United Kingdom, including in the United States. Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place in accordance with UK GDPR Chapter V.

For all transfers to the United States (Stripe, Framer, Mailerlite, PostHog), we rely on Standard Contractual Clauses (SCCs) approved by the UK ICO as the appropriate transfer safeguard. These clauses contractually require the recipient to protect your data to the same standard as required under UK law.

You can request a copy of the relevant transfer safeguards by contacting us at admin@pullupmatchmaker.com.

11. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or disclosure. These measures include:

• Encryption of data in transit using SSL/TLS protocols.

• Encryption of sensitive data at rest, including date of birth and payment-related data.

• Strict access controls limiting who within Pullup Matchmaker can access personal data.

• Regular security reviews and testing of our platform and systems.

• Data breach response procedures, including our obligation to notify the ICO within 72 hours of becoming aware of a breach where required under UK GDPR Article 33.

While we take all reasonable steps to protect your data, no system is completely secure. We encourage all users to use strong, unique passwords and to contact us immediately if they suspect any unauthorised access to their account.

12. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, including to satisfy any legal, regulatory, tax, or accounting requirements. The following retention periods apply:

Data Category	Retention Period	Reason
Account and identity data	Duration of account + 2 years	To handle post-closure queries and disputes
Payment and transaction records	7 years	HMRC legal requirement
Facial ID verification data	6 months post-verification	Minimum needed to confirm identity; then deleted
Marketing data	Until consent withdrawn	Consent-based; deleted on withdrawal
Analytics and usage data	26 months	Standard analytics retention; then anonymised or deleted
Complaints and dispute records	6 years from resolution	Limitation Act 1980 potential legal claims

At the end of each retention period, data is either securely deleted or anonymised so that it can no longer be linked to you.

13. Your Rights Under UK GDPR

Under UK GDPR you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at admin@pullupmatchmaker.com. We will respond within one month. We will not charge a fee unless your request is clearly unfounded, repetitive, or excessive.

1. Right of Access

You have the right to obtain a copy of the personal data we hold about you and information about how we process it. This is known as a Subject Access Request (SAR).

2. Right to Rectification

You have the right to ask us to correct any inaccurate personal data we hold about you, or to complete any incomplete data.

3. Right to Erasure (“Right to be Forgotten”)

You have the right to ask us to delete your personal data where there is no good reason for us to continue processing it. This right is not absolute and may not apply where we are required to retain data for legal or regulatory reasons.

4. Right to Restriction of Processing

You have the right to ask us to pause the processing of your personal data in certain circumstances for example, while we verify its accuracy or while a dispute is being resolved.

5. Right to Data Portability

Where we process your data on the basis of consent or contract and by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format, and to request that we transfer it to another organisation.

6. Right to Object

You have the right to object to processing of your personal data where we rely on legitimate interests as our lawful basis. You also have an absolute right to object to your data being used for direct marketing purposes at any time.

7. Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing including profiling that produces a legal or similarly significant effect on you. See Section 10 for details of how our matchmaking algorithm works.

14. Cookies

Our platform uses cookies and similar tracking technologies. Cookies are small text files placed on your device when you visit our website. We use cookies for essential site functionality, analytics (via framer and PostHog), and, where you have consented, marketing purposes.

You can control your cookie preferences through our cookie consent banner or through your browser settings. Disabling certain cookies may affect the functionality of our platform.

Full details of the cookies we use, their purpose, and how to manage them are set out in our Cookie Policy, available at www.pullupmatchmaker.com/cookie-policy.

15. Marketing Communications

We use Mailerlite to send marketing emails to users who have opted in to receive them. We will only send you marketing communications where you have given us your explicit consent to do so.

You can opt out of marketing communications at any time by:

• Clicking the ‘unsubscribe’ link in any marketing email we send you.

• Contacting us directly at admin@pullupmatchmaker.com.

Opting out of marketing will not affect our ability to send you transactional communications related to your account or bookings.

We will never share your personal data with third parties for their own marketing purposes.

16. Complaints and the ICO

If you are unhappy with how we have handled your personal data, we ask that you contact us first at admin@pullupmatchmaker.com so we have the opportunity to resolve your concern.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

ICO Website: www.ico.org.uk

ICO Helpline: 0303 123 1113

ICO Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

17. Changes to This Policy

We review this Privacy Policy regularly and will update it when our practices change or when required to do so by law. We will notify you of material changes by email or by a prominent notice on our platform.

This policy was last reviewed and updated in June 2026.

Pullup Matchmaker Ltd Registered in England and Wales